Auth0 integration summary

Ops-facing summary of the Harness ↔ Auth0 assessment (not the full private write-up).

Status

Portal Auth0 login is operational for the fork approach (OIDC button + password login retained).

Strengths (keep)

• Authorization-code + PKCE; timing-safe state; JWKS-validated ID token
• Link-only user ensure + signup disabled (blocks email preclaim)
• Secure session cookies behind X-Forwarded-Proto

Weaknesses (track)

• Depends on forked image, not stock harness/harness
• M2M Terraform provider secrets may need Dashboard restore after rotation
• Email is the join key (no OIDC sub binding yet)
• Fork reproducibility (commit/push/tag) still an ops goal

Conceptual model

Auth0 proves identity → map to existing Harness user → same session as password login. Auth0 remains the IdP; Harness remains the app.

---

Source wiki: ~/agent-wiki/concepts/harness-auth0-integration-assessment.md · culled 2026-09-16